Dev Log: 2026-07-09 — one source of truth, three times over

TL;DR

• Three unrelated repos, one recurring theme: derive from a single source of truth instead of duplicating it.
  


• Shipped a registry-driven sidebar section switcher (public), converged a multi-system password flow, and pushed on a customer-data identity engine.


• Details on the first two live in their own posts today.

1. Registry-driven sidebar switcher (public)

Added a section switcher to the kickoff starter kit. The sidebar, the switcher, and breadcrumbs all read the same config/menu.php list, and the active section is picked by longest URL-prefix match — so a detail page like /admin/roles/42/edit keeps its parent selected. Full write-up in the focused post.

2. One canonical password flow

Converged two apps that each rolled their own password-change/reset logic onto a single shared engine, with a fixed order (directory → external DB → local app) and no config-toggle to skip backends. A password that syncs to some systems is worse than one that fails outright, so partial success is now impossible by construction. Also fixed a subtle status bug — an unreachable backend reports skipped (a runtime fact), not disabled (a config state that no longer exists) — and added an audit log so "did it sync?" is a query, not a guess. Separate post today goes deeper.

3. Identity resolution engine (customer data work)

Steady progress on a CDP-style identity layer: an idempotent, header-versioned ingest endpoint that queues incoming records, then a resolution engine that can resolve, merge, unmerge, and quarantine profiles. Two things I care about here:

• 
  PII handling: sensitive identifiers are encrypted at rest with a blind index for lookups, and masked in audit trails — you can search on a value without storing it in the clear.


• 
  Right-to-erasure: an erasure cascade plus an erasure log, so a deletion request actually propagates and leaves a defensible record that it did.
  

ingest -> queue -> resolve -> profile

                     |

                     +-> merge / unmerge / quarantine

No code from this one here — it's teaching the shape, not the source.

Thread of the day

Different domains, same instinct: navigation, credentials, customer identity. Each got better the moment I stopped keeping two copies of the truth and made everything derive from one. Duplication doesn't announce itself as a bug until the copies disagree — usually in production.